OKChanger is a money exchange aggregator, and serves to leave positive and negative comments to ensure exchanger reputation.
There seems to be a group of fraudulent exchanges on OKChanger operated by likely a single scammer. These include but isn't limited to:
However, OKChanger itself doesn't appear to be malicious, since it was registered before these first appeared (based on versions on archive.org).
These exchanges are likely operated by the same party, since they all have the following:
- Similar webpage format and similar layout, with user reviews from and chatbox with a female operator.
- Fake reviews in forum discussions like bitcointalk.org.
- Fake reviews from new users with stock photography profile pictures, on yp.ru, Facebook, and other social media (see appendix below)
- Fake reviews on OKChanger all posted at similar times of the day.
- False company addresses listed on yp.ru, often in Eastern Europe countries (Romania, Estonia, Russia, etc.).
It is obvious that the reviews are fake, because they have standard names (Peter, John, ...), identical tone of voice across many people, saying that 'everything is great'. It is possible to tell which reviews are fake because the positive comments all have similar wording and appear at around the same time of day. Maybe they have a software script to generate them.
None of 24ATM, LucPey, VikBit show up on other money exchange aggregators:
https://bestexchangers.ru/https://www.bestchange.com/When checking 24atm.net and vikbit.com on bestexchangers.ru, they actually appear as: "The site is on the black list of exchangers!"
AnalysisFrom the history of reviews on OKChanger, there seems to have been at least hundreds of scam victims.
The scam operation seems to work as follows:
- A new domain name is registered with a name for an online currency exchanger.
- New users send in fake reviews recommending it on multiple websites, including yp.ru, Trustpilot, Facebook, Instagram, etc. There is also a fake address given for the company.
- This lures real users onto the website with real money.
- The website does not pay once the money is sent.
- User leaves negative reviews, but this is covered up by more fake reviews. A review on OKChanger claims that the exchange says that "once a customer leave negative review, then they cannot pay out any money".
- The website maintains a false legitimacy to scam new users with more fake reviews.
- Once there are too many reports, the website disappears or changes its name. The scammer proceeds to step 1 again.
These exchanges can go defunct as they burn through the reputation quickly. However, 24ATM seems to be the main one that the scammer is operating from, because it has the longest review history and was first formed.
Looking at website history, 24ATM came online in late 2020:
https://web.archive.org/web/20210615000000*/24atm.netlucpey.com came online in late 2021:
https://web.archive.org/web/20210615000000*/lucpey.comand vikbit.com came online in early 2024:
https://web.archive.org/web/20210615000000*/Vikbit.comTestingTo test out the scam and track the funds, it is possible to send in the minimum amount allowed by the website to see it travel through the blockchain.
After sending, my transaction is swept along with 10s of other Bitcoin transactions into a single wallet. After this, there is a "peel chain" pattern which splits the amount into multiple smaller addresses, which is associated with cryptocurrency mixing and money laundering, to hide destination of funds:
https://www.merklescience.com/blog/what-is-a-peel-chain-in-crypto-money-launderinghttps://framework.amltrix.com/techniques/T0070.002-peel-chainhttps://www.fraudinvestigation.net/cryptocurrency/tracing/peel-chainIn other negative reviews on OKChanger for Vikbit, victims also shared their order IDs. In 2025-10-10, someone reported they were scammed with order ID 47267. Another order is 48193 on 2026-05-05, which makes 926 orders in 217 days.
Order IDs typically increment one by one, for example, 46501 -> 46502 -> 46503, … If this is the case, then on average, the website receives about 4 orders per day. However, their Bitcoin transaction already swept more than 10 orders within a single day. Note that there are many currency pairings, not only Bitcoin, and this transaction is for BTC only, so the total volume is likely a lot higher. This indicates that this is part of a larger operation with several websites but a single operator.
Based on this we can estimate the amount processed per day. Their total amount received is ~16000 USD (1160000 RUB) in about a single day for BTC only, which shows that it is a large operation. This is equivalent to at least 365 million RUB per year (5 million USD), so this is a serious operation. If the operation existed since late 2020, then they could have collected at least 10s of millions of USD equivalent, if they take possession of all money exchanged.
SuspectSearching various websites for this person, here's what I could find about 24ATM. These were done across several search engines (Google, Yandex) using a combination of keywords and image search.
24ATM seems to be related to a man named Dmitriy Bortnik (Дмитpий Бopтник).
LinkedInURL:
https://www.linkedin.com/in/дмитpий-бopтник-25b5591b7/Page:
https://freeimage.host/i/CUKvlWuName: дмитpий бopтник
Position: Aдминиcтpaтop – 24ATM
Location: St Petersburg, St Petersburg City, Russia
Profile picture:
https://freeimage.host/i/CUKSmD7looka.oneURL:
https://looka.one/find/surname/Бopтник/name/Дмитpий/page/2 2/4Page:
https://freeimage.host/i/CUKwr42Name: Dmitry Bortnik
Country: Russia
City: Moscow
Date of birth: August 24, 1992
Profile details:
https://freeimage.host/i/CUKgsylFirst post in 2020 (coincides with when 24ATM was first created):
https://freeimage.host/i/CUK6GQSvk.ruURL:
https://top100vk.com/43311983/Page:
https://freeimage.host/i/CUKLyx4Name: Dmitry Bortnik
248 subscribers
In his profile, there is the "Дoмeн" name "goodfather90". If 90 stands for 1990, then he is 36 years old as of 2026.
In the photos tab, there are also similar photos to the 'inspirational quotes' published for the scam websites:
https://freeimage.host/i/CUKDdfpTheir profile seems to follow a summer camp called "Children's Summer Camp Romashka", which seems like a genuine clue about the person:
https://freeimage.host/i/CUflRVtDmitriy Bortnik has other profiles as well:
https://career.habr.com/24atmhttps://vk.com/id614453609https://poiski.pro/vk/user/id614453609These profiles for БOPTHИК ДMИTPИЙ ЛEOHИДOBИЧ may or may not relate to the same person:
https://zachestnyibiznes.ru/fl/780725604345https://injust.pro/person/780725604345Most webpages listed above can be accessed as of this post. Once the person of interest sees this post, he may try to remove some of these pages which uncover them, which will just further implies guilt. Screenshots have been taken, and there is also the Internet Archive at archive.org which stores backups if pages are taken down.
Of course it is possible that this identity is entirely fabricated, an that there is no real person named Dmitry Bortnik. To identify the person/group behind this, one could look into tracking the domain name registry and payment systems.
ConclusionIt is possible to report these scam websites to exchange listing companies like OKchanger, domain name registrars (reg.ru), Cloudflare, or to Google (report abuse from the search results page).
This information is made free to access and use for people who have been scammed or by law enforcement. For whoever wishes to address this, note that based on the estimates above, the offender likely possesses a large amount of ill-gotten cryptocurrency (several million USD) which can be fined, taken or repurposed. The person of interest is located in Russia, either Saint-Petersburg or Moscow.
Note that the scam is offered partly in Russian, and affects both Russian speakers and international money exchanges with foreigners.
